Managing Director Liability (Compliance)
Section 38 BSIG, § 43 GmbHG, personal liability risks
TL;DR
Managing director liability in compliance means the personal liability of the managing director for inadequate compliance structures. NIS2 / Section 38 of the German BSI Act (BSIG) is the main exposure in 2026.
What is managing director liability (compliance)?
Protective strategies:
- D&O insurance (EUR 1-5 million)
- Appoint a compliance officer
- Compliance-Kit documentation
- Document training
- Regular audits
Practical example
A NIS2 incident without documented risk management: liability under Section 38 BSIG is possible. Where management bodies breach their duty to implement and monitor the risk management measures under Section 30 BSIG, they are liable to their entity for culpably caused damage under the company law rules applicable to the legal form concerned (internal liability). The BSIG itself sets no fixed maximum amount for this; a blanket personal liability cap of 'EUR 2 million' does not exist in NIS2 law.
Legal position in Germany and Austria
Under NIS2, the personal responsibility of the management body must be kept separate from the fines: the supervisory duty of management can trigger internal liability under company law towards the entity itself, whereas the NIS2 fines are directed at the entity, not personally at the management.
Germany
- Section 38 BSIG (management duty & internal liability): the management bodies of particularly important entities and important entities must implement the risk management measures under Section 30 BSIG and monitor their implementation. In the event of a breach of duty, they are liable to their entity for culpably caused damage under the company law rules applicable to the legal form concerned — with no upper limit by amount in the BSIG.
- § 43 GmbHG: general duty of care and liability of the managing director of a GmbH towards the company.
- § 65 BSIG (fine against the entity): up to EUR 10 million (particularly important entities) or EUR 7 million (important entities); where total turnover exceeds EUR 500 million, up to 2 % or 1.4 % of worldwide turnover.
- Supervisory authority: Federal Office for Information Security (BSI).
Austria
- § 31 of the Austrian Network and Information Systems Security Act 2026 (NISG 2026) (management bodies): the management bodies of essential entities and important entities must ensure and supervise compliance with the risk management measures under § 32 NISG 2026 and attend cybersecurity training.
- § 25 GmbHG (Austria): general duty of care and liability of the managing director towards the company.
- § 45 NISG 2026 (administrative fine against the entity): up to EUR 10 million or 2 % (essential entities) and up to EUR 7 million or 1.4 % (important entities) of worldwide annual turnover, whichever is higher.
- Supervisory authority: Cybersecurity Authority (Cybersicherheitsbehörde, Austria); administrative fines are imposed by the district administrative authority.
A blanket personal liability amount of 'EUR 2 million' is provided for in NIS2 law neither in Germany (Section 38 BSIG) nor in Austria (§ 31 NISG 2026).